                                WarningTrak v1.0  
                                January 20, 1998  

SOFTWARE LICENSE AND WARRANTY AGREEMENT
      SOFTWARE LICENSE AGREEMENT


WarningTrak (Software) is the sole and exclusive property of
INTRAK, INC. (INTRAK) and is protected by U.S. Copyright laws 
and international treaty provisions.  INTRAK grants to the 
Licensee (individual or business entity) a nonexclusive, 
nontransferrable License to use the Software under the 
following terms and conditions:

1.
The Software may be installed on the number of servers for which
it has been licensed. Each independent network (a supervisor can 
log onto all the servers) requires an Initial Server License.

2.
One copy of the Software may be made for archival purposes.  All 
the information appearing on the original disk label (including 
copyright notice) must be copied onto the archival label.

3.
Licensee may not alter, decompile, disassemble or reverse-engineer 
the Software.

4.
Licensee may not rent, lease, sublicense, assign, loan, time share 
or distribute the Software and related materials.

5.
Each TrendTrak upgrade license voids the previous TrendTrak license.

LIMITED WARRANTY

The Software is only compatible with certain computers and
operating systems.  THE SOFTWARE IS NOT WARRANTED FOR NONCOMPATIBLE
SYSTEMS.

INTRAK warrants that if the magnetic media or Documentation are
in a damaged or physically defective condition at the time the
License is purchased and if they are returned to INTRAK (postage
prepaid) within 60 days of purchase, INTRAK will provide the
Licensee with replacements at no charge.

INTRAK warrants that if the Software fails to substantially
conform to the specifications in the Documentation and if the
nonconformity is reported in writing by Licensee to INTRAK
within 60 days from the date the License is purchased, then
INTRAK will either remedy the nonconformity or offer to refund
the License fee to Licensee upon return of all copies of the
Software and Documentation to INTRAK.  In the event of a refund,
the License shall terminate.

INTRAK MAKES NO WARRANTY, REPRESENTATION OR PROMISE NOT
EXPRESSLY SET FORTH IN THIS AGREEMENT.  INTRAK DISCLAIMS AND
EXCLUDES ANY AND ALL IMPLIED WARRANTIES OF MERCHANTIBILITY AND
FITNESS FOR A PARTICULAR PURPOSE.  IN NO EVENT SHALL INTRAK BE
LIABLE FOR ANY LOSS WHICH IS GREATER THAN THE LICENSE FEE PAID
BY YOU.  INTRAK SHALL NOT IN ANY CASE BE LIABLE FOR ANY DIRECT,
INDIRECT, SPECIAL, INCIDENTAL, CONSEQUENTIAL OR SIMILAR DAMAGES.

All of these exclusions or limitations may not apply in some
states.

GENERAL

If any provision of the Agreement is found to be unlawful, void
or unenforceable, then that provision shall be severed from this
Agreement and will not affect the validity and enforceability of
the remaining provisions.

This License Agreement constitutes the entire agreement between
Licensee and INTRAK.  This Agreement may only be modified in a
written amendment signed by Licensee and an authorized officer
of INTRAK.

This Agreement will be under the jurisdiction of, governed by
and construed in accordance with the laws of the State of
California of the United States of America.

All rights not specifically granted in this Agreement are
reserved by INTRAK. 


Table of Contents
 
1  WarningTrak  
  
  1.1  Overview  
  
  1.2  Setup and Installation  
    1.2.1  Software Installation  
      1.2.1.1  Installation Parameters  
      1.2.1.2  Program Location  
      1.2.1.3  Program Folder Selection  
      1.2.1.4  The SNMP Interface  
    1.2.2  Completing Setup  
  
  1.3  Un-installing WarningTrak  
  
  1.4  Removing SNMP  
  
  1.5  Starting WarningTrak  
    1.5.1  Running WarningTrak as a Service  
      1.5.1.1  Terminating the WarningTrak Service  
    1.5.2  Running WarningTrak as a Program  
      1.5.2.1  Viewing what is being tracked  
      1.5.2.2  Terminating the WarningTrak program  
    1.5.3  Starting SNMP  
  
  1.6  Errors  
    1.6.1  WarningTrak Service  
    1.6.2  SNMP Extension Agent Security Issues  
    1.6.3  Event Log Category Values  
  
2  WarningTrak Maintenance Utility  
  
  2.1  Overview  
    2.1.1  Server Information  
  
  2.2  Define Alarms  
    2.2.1  Overview  
    2.2.2  Procedure to Define an Alarm Threshold  
    2.2.3  Alarm Definitions  
      2.2.3.1  Selecting a statistic  
      2.2.3.2  Alarm Mode  
    2.2.4  Warning & Critical Settings  
      2.2.4.1  Threshold Settings  
      2.2.4.2  Alarm Recipients  
    2.2.5  Critical and Warning Suggestions Using TrendTrak Data  
      2.2.5.1  Graph  
      2.2.5.2  Peak Data  
      2.2.5.3  Average Data  
  
  2.3  Suggestion Options  
    2.3.1  Overview  
    2.3.2  Setting Warning & Critical Suggestion Formulas  
  
  2.4  Reports  
    2.4.1  Alarm Definitions  
    2.4.2  Alarm Log  
    2.4.3  Downtime Log  
      2.4.3.1  Analysis Schedule  
  
  
1  WarningTrak   
1.1  Overview  
WarningTrak is a simple to install and simple to use alarming system for Windows NT servers. Use WarningTrak to notify a SNMP monitoring workstation and/or send a message to selected people or workstations within your organization when a problem on a file server is detected. Alarms can be logged to an alarm log, Windows NT Event Log, SNMP trap and Windows NT Messenger Service.  
  
Alarm notification and threshold settings are maintained at the file server by the WarningTrak  Maintenance Utility. Each statistic can have two threshold settings, Warning and Critical. The threshold  can be either a maximum value (like System | % Total Processor Time), where notification is given when  the value exceeds the threshold setting or a minimum value (like Memory | Available Bytes), where  notification is given when the value drops below the threshold. WarningTrak provides suggested alarm  threshold settings using a seamless interface to historical statistical activity maintained by Intrak's TrendTrak. The interface to TrendTrak's data adds intelligence to the "try a threshold setting and see what  it does" guessing game.

Additionally, the WarningTrak reporting facility includes: alarm definitions, alarm notification activity and server uptime/downtime statistics.  
  
Alarms are detected and notifications sent by the WarningTrak program or WarningTrak service on the  server. This 'server only' approach, allows alarms to be detected and reported with minimal overhead and  without workstation intervention.  
  
1.2  Setup and Installation  
The Installation software is shipped on a single diskette. For your protection, make a backup copy of the  WarningTrak program diskette. You may copy the WarningTrak program disk for you own use, but be  aware that WarningTrak licensing prohibits making more than one backup copy.  
  
The WarningTrak Installation process installs all WarningTrak software and makes the necessary  adjustments to the registry. Additionally, an un-install component is installed making the removal of  WarningTrak just as easy as the installation.  
  
The installation process requires that any server being installed must be performed from the server's console or through a remote connection to the server console.  
  
1.2.1  Software Installation  
From the Windows Program Manager, choose Run from the File menu or Start then Run (NT4.0). In the  Command Line box, type a:setup if you put the installation diskette in drive A. If you are installing WarningTrak from a network file server or from a directory, type the full path plus 'setup'.  
  
The Welcome screen is displayed. Select Next to continue or Cancel to exit setup.  
  
1.2.1.1  Installation Parameters  
Installation of the Installation Parameters require a Serial Number and Alarm Data Path. These values  are placed in the Registry and are referenced by the WarningTrak program, WarningTrak service and the  WarningTrak Maintenance utility.  
  
The Serial Number is provided with the product and is located on the back of the diskette. Evaluation serial numbers are available by contacting INTRAK or one of its agents.  
  
The Alarm Data Path is the location on the server that WarningTrak places its files other than program files. Files include: warningdata.dat (threshold settings), activity.log (uptime/downtime values) and alarm.log (alarm messages). The default path is 'c:\intrak\warningtrak'. The activity.log file is small and will remain under 1KB. The warningdata.dat file will grow and shrink depending on the number of defined alarms. 10 alarm definitions require approximately 1KB of disk space. The alarm.log file is a text file and will grow depending on the number of alarm messages it contains. 60 messages, with many containing multiple lines occupies approximately 8KB of disk space.  
  
Click the Next button to continue.  
  
1.2.1.2  Program Location  
You will need to supply the path to the destination directory where you want to install the WarningTrak software, the default path is c:\Program Files\Intrak\WarningTrak.  
  
Click the Next button to continue. 
 
1.2.1.3  Program Folder Selection
Setup will add the WarningTrak program icons to the Program Folder (or Program Group icon). You can type a new folder name or select one from the existing Folders list. The Default is Intrak.

Select the Program folder.
Click the Next button to continue.

1.2.1.4  The SNMP Interface
Setup automatically installs an SNMP Extension Agent (warningtrak.dll) if SNMP has been installed on the server. The WarningTrak Extension Agent is connected to the SNMP service through Registry entries. 

The SNMP Extension Agent sends SNMP traps to the defined trap recipients. To define trap recipients, see SNMP Installation information in the Windows NT Help for more details. To remove the WarningTrak Extension Agent while leaving the remander of the WarningTrak features intact, see Removing SNMP described below.  
  
When the WarningTrak installation is complete, you will need to start the SNMP service and check the Windows NT Application Event Log for any error messages.  
  
There are no options to install SNMP.  
  
1.2.2  Completing Setup  
The final setup screen contains information on how to contact Intrak. To complete setup do the following:   

Click the Finish button to conclude the installation.  
  
When the installation is completed, the WarningTrak Maintenance Utility program is run. This utility is the mechanism to define alarms and generate reports, refer to the WarningTrak Maintenance Utility section for details.  
  
1.3  Un-installing WarningTrak  
The installation process installs a WarningTrak Un-install icon (NT 3.51) along with other WarningTrak icons, for NT 4.0 no Un-install icon is installed. The un-install process removes the program items, program group (if empty), program files and registry entries.  

Note: When un-installating WarningTrak, no WarningTrak component can be running. This includes the Maintenance utility, the program or service. If any of these components are active, a message is displayed explaining where the problem is. Address the problem and then try un-installing again.  
To Un-install WarningTrak from a NT 3.51 server:  
Click on the WarningTrak Un-install icon and follow the un-install directions.  
  
To Un-install WarningTrak from a NT 4.0 server:  
Click on the 'WarningTrak' item in the Add/Remove Programs in the Control Panel and follow the un- install directions.  
  
Data files created by WarningTrak are removed automatically. If additional files are placed itn the directory, the un-install will not remove them and you will need to remove the files. The location of the data files was defined in the Configuration Parameters | Alarm Data Path during  WarningTrak installation described earlier. The default is 'c:\intrak\warningtrak'.  
  
1.4  Removing SNMP  
The WarningTrak Extension Agent can be removed separately from the rest of WarningTrak. The extension agent is removed by the deleting Intrak item in the following registry entry:  
  
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SNMP\Para
meters\ExtensionAgents  
  
Once the extension agent entry is removed, the SNMP service needs to be stopped then started again. Also, all alarm threshold setting that reference SNMP as a notification recipient will need to be removed.  
  
1.5  Starting WarningTrak  
WarningTrak can be run as a program or as a service. In either case, the alarm settings are maintained in the warningdata.dat file that is manipulated by the WarningTrak Maintenance Utility. WarningTrak reads this file and tracks the requested statistics. Changes made by the WarningTrak Maintenance Utility are immediately detected when the utility is exited using the 'OK' button. WarningTrak then begins to track the statistics with active alarm settings.  
  
Error messages are placed in the alarm.log file. Any exceptions to this is noted in the Errors section defined below.  
  
1.5.1  Running WarningTrak as a Service  
The WarningTrak service has no user interface.  
  
To run WarningTrak as a service:  
Using the Control Panel | Services, select the WarningTrak service. Click the Start button.  
  
Note: The WarningTrak service can be set up to run automatically when the server is booted by setting the Startup Type to 'Automatic'.  
  
If an error occurs when starting the WarningTrak service, an error code is displayed. Once the service is  started, any additional error messages are placed in the alarm.log file. Refer to the Errors section for error code descriptions.  
  
1.5.1.1  Terminating the WarningTrak Service  
To terminate the WarningTrak Service:  
Using the Control Panel | Services, select the WarningTrak service  
Click the Stop button  
  
1.5.2  Running WarningTrak as a Program  
To run WarningTrak as a program, select the WarningTrak icon. The WarningTrak program can be set up to run automatically when the server console is logged into by placing the WarningTrak icon in the Startup folder or program group.  
  
When starting the WarningTrak program error messages are displayed at the console. Once the program is started, any additional error messages are placed in the alarm.log file.  
  
1.5.2.1  Viewing what is being tracked  
The WarningTrak program includes an interface that allows statistics currently being tracked to be viewed.  
  
To view the tracked statistics:  
Using the WarningTrak program, click on the View menu item.  
Click on the Alarms option.  
  
The statistics currently being tracked are displayed on the left hand side of the screen. A statistic is defined as the combination of an Object and a Counter and where applicable an Instance. The statistic's current values and it's threshold settings are also displayed.  
  
To view a specific statistic:  
Select the Object, then a Counter and if applicable an Instance to be viewed. The statistic's current status is displayed.  
  
1.5.2.2  Terminating the WarningTrak programTerminating WarningTrak will stop the watching of thresholds for the selected statistics.To terminate the WarningTrak program:
Select File from the menu.
Select the Exit option.

1.5.3  Starting SNMP
The WarningTrak portion of SNMP is and extension agent and is loaded along with the SNMP service. You must first install the SNMP portion of WarningTrak. If the SNMP service is started, stop the service, then start the service. Check the System Event Log for errors. If there are errors, check the Application Event Log for WarningTrak messages. If the SNMP service started with no errors and a trap recipient is defined, you are ready to send SNMP traps. For security issues using the SNMP interface, refer to the SNMP Extension Agent Security Issues section described below.  
  
The SNMP interface allows workstations running HP Openview, SunNet: Manager, IBM's System View, Novell's Manage Wise, and any other SNMP monitor to be recipients of WarningTrak alarms. WarningTrak has two alarm thresholds, Warning and Critical, these equate to the nlmAlertMinor Global Naming Tree number 1.3.6.1.4.1.23.2.10.1.5.18.377 and nlmAlertCritical Global Naming Tree number 1.3.6.1.4.1.23.2.10.1.5.18.231 found in the NWALERT.MIB. A copy of the NWALERT.MIB can be found on the release diskette.  
  
Once WarningTrak has generated an alarm with SNMP as a recipient, check the alarm message in the alarm.log for the SNMP recipient status and your SNMP monitoring station.  
  
1.6  Errors  
  
Error messages are placed in the alarm.log file. Any exceptions to this is noted below.  
  
1.6.1  WarningTrak Service  
The following error codes can occur when starting the WarningTrak service:  
  
  Error code  Description   
  
  1           WarningTrak registration information could not be found.
              WarningTrak has not been installed properly. Also, try
              running the WarningTrak program, any error messages are
              displayed on the console. Try re-installing the product.  
  
  2           The directory structure that contains the 
              warningdata.dat file could not be found or created. 
              This may be the result of the security level of the 
              WarningTrak service. Also, try running the WarningTrak
              program, any error messages are displayed on the console.  
  
  3           The alarm.log file could not be opened or created. This
              may be the result of the security level of the 
              WarningTrak service. Also, try running the WarningTrak 
              program, any error messages are displayed on the console.  
  
  4           The service failed to start. To reach this point, the
              registration information has been validated, the
              warningdata.dat file has been found and the alarm.log
              file has been opened. This may be the result of
              insufficient resources or a faulty SNMP installation.
              Try un-installing WarningTrak and try starting SNMP, if
              it starts, re-install WarningTrak and try re-starting.
              Also, try running the WarningTrak program, any error
              messages are displayed on the console.  
  
1.6.2  SNMP Extension Agent Security Issues  
The WarningTrak program or service communicates with the SNMP Extension Agent through a internal Windows NT mechanism. This mechanism requires that all participants (WarningTrak program to SNMP service or WarningTrak service to SNMP service) must have the same security value. For example, using the WarningTrak program, you are logged in as joe in domain cowboy (cowboy\joe), the SNMP service must be started with a log on as value of 'cowboy\joe'. This allows the two software participants to communicate. The same holds true for service to service communication, System Account to System Account is fine.  
  
1.6.3  Event Log Category Values  
The following Category Values are assoicated with messages placed in the Applications Event Log by the various WarningTrak programs:  
  
     Value     Description  
     (none)    Successful message  
     1         Warning message  
     2         Warning reset message  
     3         Critical message  
     4         Critical reset message  
     5         Error messages from the WarningTrak service  
     6         Error messages from the WarningTrak SNMP Extension Agent  
  
2  WarningTrak Maintenance Utility  
  
2.1  Overview  
Use the WarningTrak Maintenance utility to define alarm thresholds and view reports. Alarm thresholds include both warning and critical settings with possible alarm destinations of an alarm log, Windows NT Event Log, Windows NT Messenger Service and SNMP traps. WarningTrak also includes reports of alarm definitions, past alarm notification activity and server uptime/downtime.  
  
Setting alarm thresholds can be a guessing game without the benefit of past statistical activity. WarningTrak includes a seamless interface to historical statistical activity maintained by Intrak's TrendTrak. WarningTrak takes the guess work out of setting thresholds by simply selecting the Suggestion button. Suggestion information for the selected statistic  includes average and peak history along with a graph showing historical values including the suggested value. The historical data along with customizable parameters is used to compute the suggested value.  
  
Alarm settings are maintained in the warningdata.dat file. Changes are made to this file only when the OK button is selected to exit the maintenance program. The threshold settings will take effect automatically, shortly after the file has been updated. The warningdata.dat file is read by the WarningTrak program or service and threshold settings activated.  
  
All WarningTrak reports can be printed, copied to the Windows clipboard or directed to a file.  
  
2.1.1  Server Information  
The Server Information box contains basic server information. The following information is included: Server name, Windows NT version number, software build number, the current Service Pack and the current number of defined alarms.  
  
2.2  Define Alarms  
2.2.1  OverviewDefine Alarms is the process, like the title denotes, of defining alarm thresholds. Thresholds are set for a specific alarm and include both Warning and Critical settings. Thresholds can be set for ceiling values (values that go up, such as System | % Total Processor Time) or floor values (values that go down, such as Logical Disk | % Free Space).All alarm settings are maintained in the warningdata.dat file located in the c:\intrak\warningtrak (default) directory.  
  
2.2.2  Procedure to Define an Alarm Threshold  
  1.  Select an Object, Counter and an Instance if necessary.  
  2.  Select the Define Alarm button.  
  3.  Select the Alarm Mode.  
  4.  Enter the Threshold value and Trigger Duration for either the
      Warning or Critical settings, this can also be accomplished by 
      selecting the Suggestion button. The Suggestion button is
      activated if TrendTrak historical data is available for the
      selected statistic.  
  5.  Select the avenues of Notification (Alarm Log, Event Log,
      Messenger, SNMP).  
  6.  Select Active check box.  
  
2.2.3  Alarm Definitions   
  
2.2.3.1  Selecting a statistic  
A statistics is comprised of an Object and a Counter and in some cases an Instance is required. A Instance is an additional copy of the object's counters. For example, your system has two logical disks, C: and D:. When selecting the D: drive you would first select the LogicalDisk object, then the D: Instance, and then the specific counter that you want to monitor. Instances are only shown for those objects that contain them.  
  
2.2.3.2  Alarm Mode  
The Alarm Mode, Ceiling or Floor, encompasses both Warning and Critical threshold settings for the selected statistic. In other words, you cannot have the Warning values be a floor setting and at the same time have the Critical values be a ceiling setting. Ceiling values are values that are to be watched as they go up, such as System | % Total Processor Time.  

An alarm is generated when the value of the statistic exceeds the threshold setting for the Trigger Duration (time in seconds) and is reset when the value falls below the threshold setting.   
  
Floor values are values that are to watched as they go down, such as Logical Disk | % Free Space. An alarm is generated when the value of the statistic falls below the threshold setting for the Trigger Duration and is reset when the value exceeds the threshold setting.  
  
2.2.4  Warning & Critical Settings  
The Active check box when checked will set the alarm to 'active' status. The alarm settings are then passed to the WarningTrak agent when the WarningTrak Maintenance program is exited with the OK button.  
  
The Notify on Reset check box when checked will cause a notification to be sent when an alarm is over. For example, a warning ceiling threshold for the statistic System | % Total Processor Time is set to 60 with a trigger duration of 5 and a notification of SNMP. When the statistic value goes above 60% and stays there for 5 contiguous seconds, a SNMP trap notification is sent with the alarm details. When the statistic value drops below 60% a SNMP trap notification is sent with the alarm reset details.   
  
2.2.4.1  Threshold Settings  
The Threshold Value is the number that the WarningTrak agent uses to trigger the starting of an alarm event. If the value is set to 75 and the mode was ceiling. The agent would trigger an alarm event when the value exceeds 75. Likewise if the mode was floor, the agent would trigger an alarm event when the value fell below 75. In either case an alarm notification would not be sent until the Trigger Duration requirement was met.  
  
Note: There are six statistics that show values that are higher than one would expect. The statistics to note are Avg. Disk sec/Read, Avg. Disk sec/Transfer and Avg. Disk sec/Write for both the LogicalDisk and PhysicalDisk objects. The values shown are actually 1000 times greater than their actual value. For example, a displayed Avg. Disk sec/Read value of 20 is actually .020. The disk reads take .020 seconds each not 20 seconds each. When setting a threshold value, use the 20 value.  
  
The Trigger Duration is a value in seconds. A statistic needs to exceed (ceiling mode) the threshold value and stay above the threshold value continuously for the number of seconds specified in the trigger duration before an alarm notification is issued. Valid values are 0 through 999. A value of 0 will cause an immediate alarm (no waiting time).  
  
2.2.4.2  Alarm Recipients  
Alarms can be directed to a number of Alarm Recipients. Alarm Recipients include: Alarm Log, Event Log, Windows NT Messenger service and SNMP traps. An alarm setting can specify multiple Alarm Recipients.  
  
The Alarm Log is located in the c:\intrak\alrmtrak directory (default) and is created by WarningTrak program or service. All alarms with a recipient of Alarm Log are placed in the Alarm Log when the alarm is processed. The Alarm Log is an ASCII text file and can be viewed from any word processor or through the WarningTrak's Report option.  
  
The Event Log recipient is the Windows NT Event Log. All alarms with a recipient of Event Log are placed in the Event Log when the alarm is processed. The Event Log can be viewed by selecting Programs | Administrative Tools | Event Viewer (NT 4.0) or Administrative Tools | Event Viewer (NT 3.51).  
  
The Messenger recipient is the name or computer defined in the Windows NT Messenger Service. The messenger service recipient is defined by selecting Programs | Administrative Tools | Server Manager (NT 4.0) or Administrative Tools | Server Manager (NT 3.51), selecting this server's name from the list of servers, selecting Alerts and entering the user name or computer that is to receive the alarm message.  
  
The SNMP recipient allows workstations running HP Openview, SunNet: Manager, IBM's System View, Novell's Manage Wise, and any other SNMP monitor to be recipients of WarningTrak alarms. WarningTrak has two alarm thresholds, Warning and Critical, these equate to the nlmAlertMinor Global Naming Tree number 1.3.6.1.4.1.23.2.10.1.5.18.377 and nlmAlertCritical Global Naming Tree number 1.3.6.1.4.1.23.2.10.1.5.18.231 found in the NWALERT.MIB.  
  
The Suggestion option (button located within each of the Warning and Critical settings area) is activated if TrendTrak historical data is available for the selected statistic. A suggested Threshold Value and Trigger Duration is computed using the TrendTrak historical data. These suggested values are then placed in the appropriate box on the settings screen.  
  
2.2.5  Critical and Warning Suggestions Using TrendTrak Data  
  
2.2.5.1  Graph  
The graph of the selected statistic and alarm setting depicts historical values using TrendTrak data. The graph displays a value for each 15 minute period (96 values in a 24 hour period). The values generated are the result of reviewing TrendTrak data for each time period displayed in a 24 hour format. The values to graph is determined by selecting one of the four available options: Peak, Peak Average, Average or Average Average located under the Suggestion Data Selection heading. 
  
The formulas that determine the Suggested value is user configurable. The formulas can be changed by selecting the Options button.  
  
The graph also contains the suggested value (straight line) and gives a quick visual representation as it relates to the historical data. 

Suggestion Data Selection
The Suggestion Data Selection options contain the four graph selection radio buttons. These buttons determine which TrendTrak data to use to determine the values displayed on the graph. The graph selections are described below. The suggested Threshold Value and Trigger Duration is determined from the data selected and the values specified in the Suggestions\Options dialog box.  
  
Peak Values  
Peak Values are determined by analyzing the TrendTrak data for the number of days specified and using the peak data only, determining the largest value found for each time period. This means the value for 8 AM could have come from data ten days ago while the 8:15 AM value is from data 3 days ago.   

Peak Average  
Peak Average values are determined by analyzing the TrendTrak data for the number of days specified and using the peak data only, averaging the values for each time period. In other words, the value for 8 AM is determined by adding all of the 8 AM peak values for the days specified and dividing this value by the number of days specified.  
  
Average Values  
Average Values are determined by analyzing the TrendTrak data for the number of days specified and using the average data only, determining the largest value found for each time period. This means the value for 8 AM could have come from data five days ago while the 8:15 AM value is from data 12 days ago.  
  
The following example explains how one point of data (8 AM) is calculated for the Average Value graph: The Suggestions\Options values for Warning selected number of days is 15 (latest 15 days). The process to calculate the 8 AM value is to determine the greatest value using only the 8 AM values. The 8 AM TrendTrak  values for the last 15 days are 8,9,11,6,13,9,15,4,9,9,11,6,13,9,7. The value shown on the graph is 13.  
  
Average Average  
Average Average values are determined by analyzing the TrendTrak data for the number of days specified and using the average data only, averaging the values for each time period. In other words, the value for 8 AM is determined by adding all of the 8 AM average values for the days specified and dividing this value by the number of days specified.  
  
The following example explains how one point of data (8 AM) is calculated for the Average Average Value graph: The Suggestions\Options values for Warning selected number of days is 15 (latest 15 days). The process to calculate the 8 AM value is to sum the last 15 days average values using only the 8 AM values and divide by 15 (number of days selected). The 8 AM TrendTrak values are 8,9,11,6,13,9,15,4,9,9,11,6,13,9,15 the sum of these values is 147. The value shown on the graph is 9.8 (147/15).  
  
Threshold Value  
As described previously, the suggested Threshold Value and Trigger Duration is determined from the data selected and the values specified in the Suggestions\Options dialog box. The specified values, Threshold Value as % of high value for the corresponding data selection (Peak, Peak Average, etc.), Trigger Duration and the number of days of TrendTrak data determines the value. Using the Average Value example above. If the Average Value | Threshold Value as % of high value is 80, and the high value from the example is 13, then the suggested value Threshold Value is 80% of 13 or 10.4. The Trigger Duration is taken directly from the value specified in the Suggestions\Options dialog box. In this example it is also assumed that the value of 13 is also the highest value for all of the 96 time periods.  
   
Trigger Duration  
The suggested Trigger Duration (length of time in seconds) is taken directly from the corresponding data selection value specified on the Suggestions\Options dialog box. Using the example above, the Average Value | Trigger Duration specified on the Suggestions\Options dialog box is 30, than the suggested Trigger Duration displayed would be 30.  
  
2.2.5.2  Peak Data  
  
Valid Periods  
The Valid Periods is the number of TrendTrak data points that have been found from the maximum possible. TrendTrak captures 96 data points per day and over a 15 day period, the maximum possible data points would be 1440. The maximum value is determined from the value specified (latest x number of days) on the Suggestions\Options dialog box screen.  
  
High ValueThe High Value is the greatest peak value found when reviewing the Valid Periods of TrendTrak data.Average ValueThe Average Value is computed by summing all of the peak values found in the Valid Periods of TrendTrak data and dividing by the number of Valid Periods.  
  
2.2.5.3  Average Data  
  
Valid Periods  
The Valid Periods is the number of TrendTrak data points that have been found from the maximum possible. TrendTrak captures 96 data points per day and over a 15 day period, the maximum possible data points would be 1440. The maximum value is determined from the value specified (latest x number of days) on the Suggestions\Options dialog box screen.  
  
High ValueThe High Value is the greatest average value found when reviewing the Valid Periods of TrendTrak data.  
  
Average Value  
The Average Value is computed by summing all of the average values found in the Valid Periods of TrendTrak data and dividing by the number of Valid Periods.  
  
2.3  Suggestion Options  
  
2.3.1  Overview  
The Suggestion Options dialog box is used to define the components that are to be used to compute the Warning and Critical suggested values. The components include: how much TrendTrak historical data (TrendTrak Data to be used for suggestions), percentages of the peak values found in the various data selections (peak, peak average, etc.) and trigger durations.  
  
TrendTrak Data to be used for suggestions values  
The amount of TrendTrak data used to compute the suggested values range from 15 to 90 days. The latest TrendTrak data is always used. The value is specified by selecting the Latest xx days under the TrendTrak Data to be used for suggestions values heading.  
  
2.3.2  Setting Warning & Critical Suggestion Formulas  
Warning and Critical suggestion formula are comprised of two parts, a percent value and a duration. Each suggestion (Warning and Critical) has four separate suggestion formulas determined by the TrendTrak data points to be used in the calculations.   
  
The TrendTrak data points, Peak, Peak Average, Average and Average Average have been described previously. The following note may provide some guidance in determining what percentage values are to be used. Peak values are higher than average values, with the exception of slow moving statistics such as disk space (LogicalDisk | % Free Space) and in some cases the number of users connected (Server | Server Sessions). Average values tend to sustain the values longer while peak values are short lived. The Trigger Duration is used to specify how long the value must be maintained before an alarm is issued. The default settings are based on these assumptions.  
  
2.4  Reports  
  
2.4.1  Alarm Definitions  
The Alarm Definitions report provides in comprehensive detail of the current state of all defined alarms. The following is an example selection screen and report.  
  
Example ReportWarningTrak Alarm Definitions Report.  Copyright  1997 
     INTRAK, INC.
Computer Name: NT_40S  NT: Version 4.0 (Build 1381: Service Pack 3)
Number of Defined Alarms: 2

LogicalDisk  => % Disk Read Time (0 ==> C:)    
  Alarm Mode: Ceiling
  Warning Settings
    Status: Inactive, Notify on Reset: Yes, Threshold Value: 303, Trigger 
      Duration 5
    Notifications: None  
  Critical Settings  
    Status: Inactive, Notify on Reset: No, Threshold Value: 320, Trigger 
      Duration 5  
    Notifications: None  
  
Process => % Privileged Time (nttservi)  
  Alarm Mode: Ceiling  
  Warning Settings  
    Status: Inactive, Notify on Reset: No, Threshold Value: 0, Trigger Duration 0  
    Notifications: None  
  Critical Settings  
    Status: Inactive, Notify on Reset: No, Threshold Value: 0, Trigger Duration 0  
    Notifications: None  
  
2.4.2  Alarm Log  
The Alarm Log report contains WarningTrak messages and alarm settings that have designated the Alarm Log as the recipient of the alarm.  
  
The Alarm Log report provides a number of selection options. The selection options include report presentation in Time Order (newest alarm first) or Reverse Order (oldest alarm first). Additional selections include options to include or exclude the various alarm messages. Entry Selections are All Entries, Warning Alarms only, Start/Stop Entries only and Critical Alarms only. The following is an example selection screen and report. 
 
Example ReportAlarm Log for NT_40S.  Copyright  1997 INTRAK, 
INC.Created on 10/13/97 at 10:59:23 AM

WarningTrak Service stopped on 10/14/97 at 11:30:02 AM

WarningTrak Service started on 10/14/97 at 11:30:11 AM

Critical Alarm on 10/14/97 at 11:32:31 AM
Process => % Processor Time (nttservi)
Value: 6.3055, Threshold: 5, Duration: 0, Mode: Ceiling
Notification to Event Log sent.
Notification to Messenger sent.

Critical Reset on 10/14/97 at 11:32:38 AM  
Process => % Processor Time (nttservi)  
Value: 0.2374, Threshold: 5, Mode: Ceiling  
Notification to Event Log sent.  
Notification to Messenger sent.  
  
Critical Alarm on 10/14/97 at 11:32:51 AM  
Process => % Processor Time (nttservi)  
Value: 6.3074, Threshold: 5, Duration: 0, Mode: Ceiling  
Notification to Event Log sent.  
Notification to Messenger sent.  
  
Critical Reset on 10/14/97 at 11:32:52 AM  
Process => % Processor Time (nttservi)  
Value: 1.5871, Threshold: 5, Mode: Ceiling  
Notification to Event Log sent.  
Notification to Messenger sent.  
  
2.4.3  Downtime Log  
The Downtime Log contains a percentage of uptime/downtime by month. Additionally, a list of detailed events can also be displayed. The detailed events include: server up time, WarningTrak (program or service) load and unload times and server down time. The percentage of uptime/downtime is computed using the maximum available time for a given month (all days and times) or a subset of these times as set in the Analysis Schedule.  
  
WarningTrak updates a file on the server once a minute and uses this file to determine the server downtime. Using the server up time and the last WarningTrak time, the server up/downtime is determined.  This process provides an accurate representation of the server's uptime/downtime as long as the WarningTrak is loaded as part of the server's start up process and WarningTrak remains active.   
  
The percentages in the Downtime Log are computed using the number of minutes in a month or the number of minutes selected in the 'focus range' requested in the Analysis Schedule. Small amounts of downtime may not be reflected in the percentage values even though the percentage values include two decimal places. For example, the month of June contains 43,200 minutes. A downtime of 2 hours (120 minutes) would result in a downtime percentage of .0028. Using the two decimal places, this value will be shown as 0.00% downtime. Using a focus range of 8-5 Monday through Friday would result in a downtime percentage of 0.01 (8640 minutes / 120 = 014%).  
  
The downtime log can be printed, copied to the Windows clipboard or copied to a file. The following example shows the Server Downtime Log without detailed information. The report picks up the original server up time (first line by month), the time for that month that is before server start up is reported as 'Unknown' time. A similar 'Unknown' value is given for the last monthly line (this is the time from now to the end of the month).  
  
Note: A detailed description value of 'None' indicates that there were no downtime details reported during the month.

2.4.3.1  Analysis Schedule
The Analysis Schedule allows a subset of the maximum time for a given month to be used to determine the percentage of uptime/downtime. For example, you are interested in the uptime for the times of 8 AM to 5 PM Monday through Friday. The percent calculation(s) will only include the selected hours (highlighted) and any uptime/downtime outside of the selected times (not highlighted) are ignored.  
  
The Analysis Schedule dialog box displays the time for each day of the week in 15 minute increments. The colored areas (note the colored box in the right hand bottom corner of the folder next to the caption "Selected Periods") indicate the times selected (highlighted) for calculations. White areas indicate un-selected (not highlighted) time and will not be used for percentage calculations. The time displayed in the box titled "Focus Range" confirms the time block selected.  
  
Set AllThe Set All button causes all time areas to become selected (highlighted). Selected time areas are used in the downtime calculations.Clear AllThe Clear All button causes all time areas to become un-selected (not highlighted). Un-selected time areas are not used in the downtime calculations.  
  
Invert All  
The Invert All button causes all selected time areas to become un-selected and at the same time all un-selected time areas to become selected. Only selected time areas are used in the downtime calculations.  
  
Set Focus  
The Set Focus button causes the banded time areas (areas selected while holding down the left mouse button) to be selected (highlighted). Only selected time areas are used in the downtime calculations.  

Clear Focus  
The Clear Focus button causes the banded time areas (areas selected while holding down the left mouse button) to be un-selected (not highlighted). Only selected time areas are used in the downtime calculations.  

Invert Focus  
The Invert Focus button causes the banded time areas (areas selected while holding down the left mouse button) to be un-selected (not highlighted) if the time areas are currently selected and vice versa. Only selected time areas are used in the downtime calculations.  
  
If the result of the modification is less than 'all days and times', The Downtime Log Header is modified to contain the text string 'Using Analysis Schedule'. The header character string is modifiable and is placed in the first line of the Downtime Log.  
  
Use the following procedure to modify the Analysis Schedule:  
  
To activate a single time slot:  
Use the mouse to locate the time slot to be activated. 
Click the left mouse button, this will change the color of the time slot.  
Click the left mouse button on the Set Focus button.  
  
To activate a block of time:  
Use the mouse to locate the upper left corner of the time block to be activated. 
Click the left mouse button (this will change the color of the time slot) and drag the mouse to the lower right corner of the time block. All time areas can be activated by selecting the Set All button.  
Click the left mouse button on the Set Focus button.  
  
To de-activate a single time slot:
Use the mouse to locate the time slot to be activated. 
Click the left mouse button, this will change the color of the time slot.
Click the left mouse button on the Clear Focus button or Alt+C keys.

To de-activate a block of time:
Use the mouse to locate the upper left corner of the time block to be activated. 
Click the left mouse button (this will change the color of the time slot) and drag the mouse to the lower right corner of the time block. All time areas can be de-activated by selecting the Clear All button.  
Click the left mouse button on the Clear Focus button or Alt+C keys.  


